This responds to your August 4, 2005, letter regarding the Family Educational Rights and Privacy Act (FERPA) (20 U.S.C. §1232g) as it applies to law enforcement units at educational agencies and institutions. Specifically, you asked for clarification as to when student witness statements and reports made by school security staff of the Montgomery County Public Schools (District) should be considered law enforcement records and when they should be considered student education records subject to FERPA. As you know, this Office administers FERPA and provides technical assistance to educational agencies and institutions to ensure compliance with the statute and regulations, which are codified at 34 CFR Part 99.

In your letter, you explain that the District employs approximately 180 school security staff to monitor safety and security on its various school campuses. You explain that in addition to the security staff, the District has entered into a Memorandum of Understanding (MOU) with the Montgomery County Department of Police (Police Department), which assigns police officers - referred to as Educational Facilities Officers (EFOs) - to specific schools in the District. With regard to your question about the records maintained by the District's security staff, you explain the following:

In some incidents, the EFOs or other investigating police officers have taken the position that witness statements obtained by school security staff have been obtained for law enforcement purposes and should be made immediately available to law enforcement officers, as an exception to FERPA, especially in situations in which the school incident involved behavior violating criminal law. Representatives of the MCPD and Montgomery County State's Attorney's Office assert that they are entitled to access student statements and school security reports without obtaining a subpoena for these documents. The EFOs state in many situations, the investigative reports and witness statements secured by school security are prepared in furtherance of a law enforcement purpose and constitute the records of a law enforcement unit pursuant to 34 CFR sec. 99.8.

The school district is concerned that school security staff, as school system employees, primarily support the administration and discipline of the schools and would not qualify as a separate law enforcement unit under FERPA. The investigations they conduct and witness statements they obtain are typically given to the school administration for use in student disciplinary matters.

FERPA is a Federal law that affords parents the right to have access to their children's education records, the right to seek to have the records amended, and the right to have some control over the disclosure of information from the records. When a student reaches 18 years of age or attends a postsecondary institution, he or she becomes an "eligible student" and all rights under FERPA transfer from the parent to the student. FERPA defines "education records" as "those records, files, documents, and other materials which -

(i) contain information directly related to a student; and

(ii)are maintained by an educational agency or institution or by a person acting for such agency or institution.

20 U.S.C. §1232g(a)(4)(i) and (ii). FERPA applies to the disclosure of tangible records and of information derived from tangible records. FERPA does not protect the confidentiality of information in general, and, therefore, does not apply to the disclosure of information derived from a source other than education records, even if education records exist which contain that information. As a general rule, information that is obtained through personal knowledge or observation, and not from an education record, is not protected from disclosure under FERPA. Furthermore, information that is maintained by a school that does not relate to a student in attendance at that school does not meet the definition of an education record. (See 34 CFR §99.3 "Student.")

In July 1992, FERPA was amended to remove an impediment to the release of records created and maintained by a school's law enforcement unit for a law enforcement purpose. Specifically, FERPA was amended to exempt from the definition of "education records" the following:

[R]ecords maintained by a law enforcement unit of the educational agency or institution that were created by that law enforcement unit for the purpose of law enforcement.

20 U.S.C. §1232g(a)(4)(ii). The amendment neither requires nor prohibits the release of law enforcement unit records, but allows schools to follow their own policies or applicable State law. Accordingly, FERPA no longer prevents a campus law enforcement division from disclosing to outside parties law enforcement unit records, including campus security incident reports, that were created by the law enforcement unit for a law enforcement purpose.

The FERP A regulations define a "law enforcement unit" as the following:

(a)(l) "Law enforcement unit" means any individual, office, department, division, or other component of an educational agency or institution, such as a unit of commissioned police officers or non-commissioned security guards, that is officially authorized or designated by that agency or institution to -

(i) Enforce any local, State, or Federal law, or refer to appropriate authorities a matter for enforcement of any local, State, or Federal law again any individual or organization other than the agency or institution itself; and

(ii) Maintain the physical security and safety of the agency or institution.

(b)(1) Records of a law enforcement unit means those records, files, documents, and other materials that are -

(i) Created by a law enforcement unit; Created

(ii) for a law enforcement purpose; and

Maintained by the law enforcement unit.

34 CFR §99.8(b)(l)(i)-(iii).

Thus, it would appear from the information you have provided that the District's security staff would constitute a law enforcement unit under FERP A, assuming that the District has so designated it as such. The District will also want to be sure that its annual notification of rights under FERP A include criteria that would include the law enforcement unit officials as "school officials" with "legitimate educational interest." (See 34 CFR §99.7.) Additionally, the records created by the District's law enforcement unit that meet the description of "law enforcement records," as cited above, would be law enforcement unit records and, as such, may be shared with outside third parties, including the Police Department and the County State's Attorney's Office.

This does not prevent the District's security staff from also performing non-law enforcement unit functions such as administrative support and/or the disciplinary functions of the District. When implementing the changes to the FERPA regulations concerning law enforcement units and their records, the Department responded to comments made on the proposed regulations in which a school official noted that, at his institution, the law enforcement unit and the functions of the student affairs office charged with administering the student discipline system are "intertwined," as they are at other institutions. In the preamble to the FERP A regulations published in the Federal Register on January 17, 1995, (60 FR 3467), copy enclosed, we provided the following response to this comment:

If an institution has a security unit or individual with a dual role or function of enforcing institutional rules of conduct related to safety and security and referring potential or alleged violations of law to government authorities, that unit or individual would be considered a "law enforcement unit" under FERPA. Under the new amendment, records of that unit are were created and maintained for a law enforcement purpose are considered records of a law enforcement unit and, therefore, excluded from the definition of "education records" under FERPA.

[W]here a law enforcement unit also performs non-law enforcement functions, the records created and maintained by that unit are considered law enforcement unit records, even where those records were created for dual purposes (e.g. for both law enforcement and disciplinary purposes). Only records that were created and maintained by the unit exclusively for a non-law enforcement purpose will not be considered records of a law enforcement unit.

(Emphasis provided.) Thus, a law enforcement official may disclose a copy of a law enforcement unit record to a school official responsible for discipline and the record at the law enforcement unit would not lose its status as a "law enforcement unit record." However, the copy of the record that was disclosed to the school official who is not a law enforcement official becomes an "education record" subject to FERPA. That is because the copy of the record that is released is not "maintained by the law enforcement unit" but is now maintained by a component of the school that is not the law enforcement unit.

Conversely, education records that are shared with the school's law enforcement unit do not lose their status as "education records" and must be protected as such in the possession of the law enforcement unit. As explained in §99.8 of the regulations -

(b)(2) Records of law enforcement unit does not mean -

(i) Records created by a law enforcement unit for a law enforcement purpose that are maintained by a component other than the law enforcement unit; or

(ii) Records created and maintained by a law enforcement unit exclusively for a non-law enforcement purpose, such as a disciplinary action or proceeding conducted by the educational agency or institution.

(c)(2) Education records, and personally identifiable information contained in education records, do not lose their status as education records and remain subject to the Act, including the provisions of §99.30 while in the possession of the law enforcement unit.

Accordingly, when a school's law enforcement unit receives personally identifiable information from a student's education records, that information must be protected under FERPA and not disclosed unless authorized by FERPA. Please see the enclosed April 26, 1995, letter to the University of New Mexico wherein this Office found the school in violation of FERPA because its campus law enforcement unit disclosed information from a student's education records to a newspaper reporter. The information about the student's disciplinary proceeding and decision was contained in an incident report which was disclosed to the media under the State's open records law. While the law enforcement unit needed to know that the results of the disciplinary proceeding (that the student had been banned from campus), it was not permitted under FERPA to further release that information.

Therefore, with regard to your specific question - when should student witness statements and reports made by school security staff be considered law enforcement records and when should they be considered education records subject to FERPA - the answer to this question depends on who created the records, for what purpose the records were created, and who maintains the records. We believe that the discussion on this matter in the same preamble in the Federal Register referenced above will shed some light on the meaning of the regulations:

[I]f a campus security unit initiates an investigation into an incident on campus relating to a possible violation of law or the student conduct code, the record created and maintained by the unit in connection with this investigation is a law enforcement unit record, whether or not it is ever referred to the local police authorities. If, however, the same unit or individual responsible for law enforcement investigates an incident for the purposes of internal disciplinary actions and created a records exclusively for the purpose of a possible disciplinary action against the student, that record would not be considered a record of a law enforcement unit and would be an "education record" subject to FERPA. It should be stressed that the Secretary expects such occasions to be very rare, especially when incidents involving criminal conduct by students at postsecondary institutions.

Emphasis supplied. (The cautionary sentence was added because postsecondary institutions have certain reporting requirements under the Higher Education Act of 1965, as amended. See 34 CFR §668.46.) Thus, as long as the District's security staff is aware of the requirements of FERP A with regard to law enforcement unit records and education records, the security staff may serve as the District's law enforcement unit and also assist the District with administrative and disciplinary functions.

With regard to the MOU between the District and the Police Department, please note that an educational agency or institution may not disclose education records without prior written consent merely because it enters into a contract with an outside party. Rather, the agency or institution must be able to show that 1) the outside party provides a service that the agency or institution would otherwise provide for itself using employees; 2) the outside party would have "legitimate educational interests" in the information disclosed if the service were performed by employees, for example, employed security staff; and 3) the outside party is an agent under the direct control of the educational agency or institution with respect to the use and maintenance of information from education records.

Further, under §99.33(a) of the regulations, any party, including a "school official," that receives education records may use the information only for the purposes for which the disclosure was made and may not redisclose the information to any other party without prior written consent, except as authorized under §99.33(b). Education records maintained by a party acting for or on behalf of an educational agency or institution, including record created by that party, are subject to all FERPA requirements. A contractor, consultant, volunteer or other party retained to provide services for an educational agency or institution that does not meet these requirements may not be given access to personally identifiable information from education records without meeting the prior written consent requirements.

We note that the MOU specifically states that any information sharing between the District and the Police Department "will follow protocols that currently exist between the Police Department and [the District] in accordance with applicable federal, state, and local laws." Based on this statement, we assume that EFOs are not being provided access to students' education records that might be maintained by the District's security staff. However, as explained above, nothing in FERP A would prohibit the District's security staff from sharing information from law enforcement unit records with EFOs. In order for members of the District's security staff to have access to students' education records, the security staff must be considered "school officials" with a "legitimate educational interest." One of the exceptions to FERPA's prior written consent requirement allows "school officials" to have access to a student's education records, without prior written consent, under §99.31(a)(l) of the regulations, but only if they have a "legitimate educational interest."

As referenced above, under §99.7 of the FERPA regulations, schools are required to provide parents and eligible students annual notification of their rights under FERPA. As part of the notification, schools must include a specification of criteria for determining who constitutes a "school official" and what constitutes a "legitimate educational interest." Enclosed is a copy of a model notification that also appears on our website (http://www.ed.gov/policy/gen/guid/fpco/ferpa/lea-officials.html), providing sample language that schools may use. Generally, a school official has a legitimate if the official needs to review an education record in order to fulfill his or her professional responsibilities for the school.

We note that, in your letter, you stated that EFOs and the District's security staff work very closely in investigating possible violation of criminal laws. Accordingly, should the District believe that in order for the District to carry out its law enforcement unit functions and responsibilities the EFOs must have access to students' education records, the District could designate EFOs as "school officials" with a "legitimate educational interest." However, EFOs may not disclose information they have obtained from students' education records to the Police Department, unless the disclosure meets one of the exceptions to consent specified in §99.31 of FERPA.

Some school districts make special arrangements with local law enforcement authorities for the purpose of maintaining safe and drug-free schools. Although the Department encourages schools without separate law enforcement units to develop working relationships with local police authorities, compliance with FERPA calls for certain precautions. School districts should clearly designate the police officer or a group of commissioned officers as the law enforcement unit and as school officials in the school's annual FERPA notification. This is so that schools may freely share information about students with their law enforcement units and so that parents and students will know that information from education records may be disclosed for the purpose of maintaining safe schools. Again, please note that these law enforcement unit officials - whether part of the school system or an officer(s) under special arrangements with the school- are not permitted to disclose education records to local police authorities, unless the disclosure meets one of the exceptions in §99.31 of the FERP A regulations.

You state that situations in which both school security staff and the EFOs are present during the interviewing of students or the writing of their statements are particularly problematic. As a preliminary matter, FERPA does not address the actual interviewing of students, but it does address the records created by the interview process once they are maintained by a school or a party acting for the school. Based on our understanding of the current status of EFOs, they are not school officials with legitimate educational interest. Accordingly, should an EFO interview a student on campus and then depart with those records, there is no FERPA implication. That is because the notes taken and maintained by the EFO are not maintained by the school district or a party acting for the school district. Conversely, if a student is interviewed by school security staff and the records are maintained by the security staff; those records could be education records if they were not created for a law enforcement purpose. From the information you provided, in some instances the security staff is creating the records for a disciplinary measure, and not for a law enforcement purpose.

For example, you explain that when a serious incident, such as assault, drug use and distribution, or possession of a deadly weapon, occurs on school premises that involves students, the EFOs undertake an investigation to determine if criminal laws have been violated and usually seek access to the witness statements and the reports prepared by school security. In this case, it is likely that the school security, i.e. the law enforcement unit took statements from students for a law enforcement purpose. If that is the case, the EFOs can have access to those records in compliance with FERPA. If, however, the law enforcement unit created those records for other than a law enforcement purpose -- thus making them education records-- the EFO cannot have access absent prior parental consent unless, of course, the EFO is an appropriately designated school official as described above.

As mentioned earlier in the discussion, the District needs to consider whether the individual being interviewed in order to determine whether FERPA applies to any records that are created during the interview process. The term "student" is defined as any individual who is or has been in attendance at an educational agency or institution. 34 CFR §99.3 "Student." Therefore, when school security staff question unauthorized visitors, there might be cases where such visitors would not be a "student." As such, FERPA would not apply to records created about him or her.

Additionally, FERPA would permit the District to disclose personally identifiable information from a student's education record under FERPA's health and safety emergency provision: This provision allows an educational agency or institution to disclose personally identifiable information from education records, without prior written consent,

in connection with an emergency [to] appropriate persons if the knowledge of such information is necessary to protect the health or safety of the student or other persons.

20 U.S.C. §1232g(b)(1)(I); 34 CFR §§99.31(a)(10) 99.36.

Section 99.31(a)(1O) of the regulations provides that the disclosure must be "in connection with a health or safety emergency" under the following additional conditions:

An educational agency or institution may disclose personally identifiable information from an education record to appropriate parties in connection with an emergency if knowledge of the information is necessary to protect the health or safety of the student or other individuals.

34 CFR §99.36(a)(Emphases added.) In accordance with congressional direction, the regulations provide further that these requirements will be strictly construed. 34 CFR §99.36(c).

The Department has consistently interpreted this provision narrowly by limiting its application to a specific situation that presents imminent danger to students or other members of the community, or that requires an immediate need for information in order to avert or diffuse serious threats to the safety or health of a student or other individuals. While the exception is not limited to emergencies caused by terrorist attacks, the Department's Guidance on "Recent Amendments to [FERPA] Relating to Anti-Terrorism Activities," issued by this Office on April 12, 2002, provides a useful and relevant summary of our interpretation. We have enclosed a copy of that guidance, which is also found on our website at http://www.ed.gov/policy/gen/guid/fpco/pdf/htterrorism.pdf.

This document also contains a discussion of the provision in FERPA that permits schools to disclose personally identifiable information in order to comply with a subpoena or court order. As you know, FERPA permits the nonconsensual disclosure of education records when the disclosure is made in compliance with a lawfully issued subpoena or court order if the educational agency or institution makes a reasonable attempt to notify the parent or eligible student of the order or subpoena in advance of compliance. 20 U.S.C. §1232g(b)(2)(B); 34 CFR §99.31(a)(9). Section 99.32 of the FERPA regulations generally requires that an educational agency or institution maintain a record of all requests for access to and disclosures from education records. However, we have determined that such recordation would not be required when the disclosure was made in compliance with a judicial order or subpoena so long as the school was successful in its attempt to notify the parent or eligible student of the order or subpoena in advance of compliance.

We hope this letter is helpful in explaining FERPA as it applies to law enforcement unit records and that it clarifies the conditions that must exist in order for them to be "law enforcement unit records" under FERPA. Because schools may not have a policy or practice of noncompliance with FERPA, this Office will investigate an allegation from a student that contains specific allegation of fact indicating that information from his or her education records was improperly disclosed. The District should ensure that appropriate school officials and its law enforcement unit understand and comply with the provisions outlined in this letter.